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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 



Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even If timely filed, may reduce any 
earned patent terni adjustment. See 37 CFR 1.704(b). 

Status 

1 )^ Responsive to communication(s) filed on 10 December 2001 . 
2a)n This action is FINAL. 2b)S This action is non-final. 

3) D Since this application is in condition for allowance except for fomnal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1 935 CD. 1 1 . 453 O.G. 21 3. 

Disposition of Claims 

4) 13 Claim(s) 1-32 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) S Claim(s) 1-32 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10)K The drawing(s) filed on 10 December 2001 is/are: a)^ accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required If the drawing(s) is objected to. See 37 CFR 1.121(d). 
11 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)n All b)n Some * c)^ None of: 

1 .□ Certified copies of the priority documents have been received. 

2, n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mall Date. . 

3) □ Infomiation Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5) □ Notice of Infomial Patent Application (PTO-152) 

Paper No(s)/Mall Date . 6) D Other: . 
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DETAILED ACTION 



1 . This Office Action is in response to the application filed on December 10, 200 L 

2. Claims 1-32 are presented for examination. Claims 1, 8, 15, 21, and 27 are independent 
claims. 

Specification 

3. The abstract of the disclosure is objected to because it exceeds the limit of 150 words. 
Correction is required. See MPEP § 608.01(b). 

Claim Rejections - 55 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 
102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the 
subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill 
in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

5. Claims 1-32 are rejected under 35 U.S.C. 103(a) as being unpatentable over Al-Ghosein 
et al. (U.S. 6,473,791 Bl) in view of Hunt (U.S. 6,230,312 Bl). 



6. 



As to claim 1: 

a. Al-Ghosein teaches the invention substantially as claimed including a method for 
applying one or more policy constraints (security policies; see the abstract) in an 
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application program (applications; see the abstract)^ the method comprising the 
computer-implemented step of: redirecting a request to invoke a routine contained 
in the application program to a policy broker (system components 60 1 -60n 'e.g., 
applications * make calls to an intelligent trust manager 62 in order to have trust 
decisions made therefor in accordance with a predetermined policy. To obtain a 
decision, the intelligent trust manager 62 in turn communicates with a policy 
manager 64; col4, lines 12-18) wherein the processing of the request to invoke 
the routine by the policy broker causes the one or more policy constraints to be 
applied to invocation of the routine (a policy manager 64 to invoke an 
appropriate one of the policy objects 66 j- 66n^ The corresponding policy object 
'e.g. 663 ' makes an advisory decision, i.e., yes, no or insufficient information to 
make a determination, and returns the decision to the system component (e.g., 
60 j) via the intelligent trust manager 62; col4, lines 17-23), 
h, Al-Ghosein does not specifically teach "without modifying program code." 

c. Himt teaches without modifying program code (without modifying application 
sources; col. 3 7, lines 22-29). 

d. It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to combine the teachings of Al-Ghosein with Hunt because 
Himt's teachings would allowed a programmer to insert or remove constraints on 
a specific application without changing the application sources. Therefore, 
reducing cost and improving performance and efficiency of Al-Ghosein's system. 
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7. As to claim 2: 

Al-Ghosein teaches the redirecting of the request to the poUcy broker is performed by 
invoking a routine managed by the policy broker (to obtain a decision, the intelligent 
trust manager 62 in turn communicates with a policy manager 64 to invoke an 
appropriate one of the policy objects 66r 66n; coL4, lines 16-19). 

8. As to claim 3: 

Al-Ghosein teaches substituting original code contained in the routine with replacement 
code that invokes a routine managed by the policy broker (to replace a policy,., invoke 
the other policy instead of the existing policy: col.4, lines 38-42). 

9. As to claim 4: 

Al-Ghosein teaches the replacement code includes only code that invokes a routine 
managed by the policy broker (policy objects are COM objects, they include executable 
code for making decisions; col.4, lines 46-47). 

10. As to claim 5: 

a. Hunt teaches the original code is original source code and the replacement code is 



replacement source code (source code; col.51, lines 31-36 and col.55, lines 26- 



27). 



b. 



It would have been obvious to a person of ordinary skill in the art at the time the 



invention was made to combine the teachings of Al-Ghosein with Hunt because 



Hunt's teachings would have provided the capabiUty for automatically detecting 



location constraints on the placement of units of an application program. 



11. 



As to claim 6: 
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a. Hunt teaches the original code is original object code and the replacement code is 
replacement object code (object; colSl, lines 31-36 and coL55, lines 24-25). 

h. It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to combine the teachings of Al-Ghosein with Hunt because 
Hvmt's teachings would have provided the capability for automatically detecting 
location constraints on the placement of units of an application program. 

12. As to claim 7: 

Al-Ghosein teaches the one or more policy constraints include one or more security 
constraints (if a decision to access a file for read and write, „a security identifier is 
needed; col6, lines 5-11), 

13. As to claim 8: 

It is directed to a computer-readable medium for implementing the method of claim 1 
above, and is similarly rejected under the same rationale. Additionally, Al-Ghosein 
further teaches one or more processors (see fig, 2). 

14. As to claims 9-14: 

They are directed to a computer-readable medium for implementing the method of claims 
2-7 above, and are similarly rejected under the same rationale. 

15. As to claim 15 ; 

a. Al-Ghosein teaches the invention substantially as claimed including a method for 
implementing policy constraints (implementing security policies; see the abstract) 
in an application program (applications; see the abstract), the method comprising 
the computer-implemented steps of: identifying a routine in the application 
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program for which one or more policy constraints are to be applied, wherein the 
routine is invoked by program code contained in the apphcation program 
(applications create a request describing an action that needs to be checked 
against an appropriate security policy. The request is given to a trust system that 
determines which policy object applies to the request; see the abstract); and 
substituting replacement code for original code contained in the identified routine 
(to replace a policy with another policy... invoke the other policy instead of the 
existing policy; coL 4, lines 38-42), wherein execution of the replacement code by 
one or more processors causes the one or more policy constraints to be appUed 
(allows policies to be shared by numerous system components; col 4, lines 43- 
46). 

b. Al-Ghosein does not specifically teach "without modifying program code." 

c. Hunt teaches without modifying program code (without modifying application 
sources; col. 3 7, lines 22-29). 

d. It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to combine the teachings of Al-Ghosein with Hunt because 
Hunt's teachings would allowed a programmer to insert or remove constraints on 
a specific application without modifying the application sources. 

16. As to claim 16: 

Al-Ghosein teaches the substitution of the replacement code for the original code is 
performed without changing any calls to the routine that are contained in the application 
program (col.4, lines 35-42). 
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17. As to claim 17: 

Al-Ghosein teaches the replacement code contains the original code (coL4, lines 63-66), 

18. As to claims 18-20: 

They include the same limitations as in claims 5-7 above, and are similarly rejected under 
the same rationale. 

19. As to claim 21 ; 

It is directed to a computer-readable medium for implementing the method of claim 15 
above, and is similarly rejected xmder the same rationale. 
20 As to claims 22 and 23: 

They include the same limitations as in claims 16 and 17 above, and are similarly rejected 
under the same rationale. 

21 . As to claims 24-26: 

They include the same limitations as in claims 5-7 above, and are similarly rejected under 
the same rationale. 

22. As to claim 27 : 

It is directed to an apparatus for performing the method of claim 15 above, and is 
similarly rejected under the same rationale. Additionally, Al-Ghosein further teaches a 
memory (a system memory 22; col.2, lines 45-46). 

23. As to claims 28 and 29: 

They include the same limitations as in claims 16 and 17 above, and are similarly rejected 
under the same rationale. 
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24. As to claims 30-32: 

They include the same limitations as in claims 5-7 above, and are similarly rejected under 
the same rationale. 

Conclusion 

25. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

(i) Britton et al. (U.S. 6681380) teaches "Aggregating constraints and/or 
preferences using an inference engine and enhanced scripting language." 

(ii) Choi et al. (U.S. 6487716) teaches "Methods and apparatus for optimizing 
programs in the presence of exceptions." 

(iii) Archer (U.S. 6473748) teaches "System for implementing rules." 

(iv) Griffin et al. (U.S. 5513350) teaches "Update constraints in transactions 
which may abort." 

(v) Alhusaini et al. "A framework for mapping with resource co-allocation in 
heterogeneous computing systems" 2000 IEEE, pp. 1-14. 

(vi) Liu et al. "An agent based architecture for supporting application level 
security" 2000 IEEE, pp. 1-12. 
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27. 



28. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to VAN H. NGUYEN whose telephone number is (571) 
272-3765. The examiner can normally be reached on Monday-Thursday from 8:30AM - 
6:00PM. The examiner can also be reached on alternative Friday. 
If attempts to reach the examiner by telephone are unsuccessfiil, the examiner's 
supervisor, Meng-Ai An can be reached on (571) 272-3756. 

The fax phone number for the organization where this application or proceeding is 
assigned is 703-872-9306. 

Information regarding the status of an appHcation may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
appUcations may be obtained from either Private PAIR or Pubhc PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 

Any response to this action should be mailed to: 

Commissioner for patents 
POBox 1450 

Alexandria, VA 22313-1450 




Van H. Nguyen 



